6 ms·

There's something about their favicon being the default green lock ( https://https.cio.gov/assets/favicon.ico https://https.cio.gov/assets/favicon.ico ) that un

by kysol 12y ago

There's something about their favicon being the default green lock ( https://https.cio.gov/assets/favicon.ico https://https.cio.gov/assets/favicon.ico ) that unsettles me. It feels like a social engineering trick.

LeoPanthera 12y ago
Suddenly, Safari's behaviour of hiding the favicon unless you click the address, makes sense.
- kysol 12y ago
  From what I was reading, the removal of the favicon in Safari was more just a UI redesign decision to remove "clutter". Personally I don't find a 16x16 icon too intrusive, but hey, what ever floats their boat. I was hoping that it was as you said, and was to prevent maliciously designed favicons from tricking users on plaintext sites (where the protocol had been stripped by the UI) into thinking they were on a secure site. I don't use Safari, so I don't know how they render their address bar.
konklone 12y ago
That's an interesting point. I'll be straight, it's lifted right from https://istlsfastyet.com https://istlsfastyet.com. And cio.gov is in the HSTS preload list [1] so (once the list makes it into stable channels) the chances of the domain being downgraded to plaintext are pretty low. But I had not thought of that angle. Hmm. [1] https://18f.gsa.gov/2015/02/09/the-first-gov-domains-hardcoded-into-your-browser-as-all-https/ https://18f.gsa.gov/2015/02/09/the-first-gov-domains-hardcod...
- kysol 12y ago
  ..and people complain about transparency :) I wasn't calling it a social engineering trick, more that it just felt like one. To the average person they wouldn't second guess the icon. To those who believe in HTTPSAllTheThings, we question anything out of the ordinary.. and that little padlock shouldn't appear in the tab. As I said, it just felt weird, sort of the same feeling you get when you go to Apple or YouTube and there's a warning on the lock icon. You just want to hit the back button almost instantly fearing something dodgy is happening.
  - Already__Taken 12y ago
    You were absolutely right in calling it a trick. Browsers explicitly[0] stopped putting the favicon there as sites started to trick users like this. Seems like an odd choice of UI chrome that browsers decided to keep. 0: http://www.wired.co.uk/news/archive/2012-04/25/firefox-fires-favicon http://www.wired.co.uk/news/archive/2012-04/25/firefox-fires...
schoen 12y ago
sslstrip had an option to do this in order to increase the chance that the user is fooled into not noticing the downgrade attack.

by kysol 12y ago

LeoPanthera 12y ago

Suddenly, Safari's behaviour of hiding the favicon unless you click the address, makes sense.

kysol 12y ago
From what I was reading, the removal of the favicon in Safari was more just a UI redesign decision to remove "clutter". Personally I don't find a 16x16 icon too intrusive, but hey, what ever floats their boat. I was hoping that it was as you said, and was to prevent maliciously designed favicons from tricking users on plaintext sites (where the protocol had been stripped by the UI) into thinking they were on a secure site. I don't use Safari, so I don't know how they render their address bar.

konklone 12y ago

That's an interesting point. I'll be straight, it's lifted right from https://istlsfastyet.com https://istlsfastyet.com. And cio.gov is in the HSTS preload list [1] so (once the list makes it into stable channels) the chances of the domain being downgraded to plaintext are pretty low. But I had not thought of that angle. Hmm. [1] https://18f.gsa.gov/2015/02/09/the-first-gov-domains-hardcoded-into-your-browser-as-all-https/ https://18f.gsa.gov/2015/02/09/the-first-gov-domains-hardcod...

kysol 12y ago
..and people complain about transparency :) I wasn't calling it a social engineering trick, more that it just felt like one. To the average person they wouldn't second guess the icon. To those who believe in HTTPSAllTheThings, we question anything out of the ordinary.. and that little padlock shouldn't appear in the tab. As I said, it just felt weird, sort of the same feeling you get when you go to Apple or YouTube and there's a warning on the lock icon. You just want to hit the back button almost instantly fearing something dodgy is happening.
- Already__Taken 12y ago
  You were absolutely right in calling it a trick. Browsers explicitly[0] stopped putting the favicon there as sites started to trick users like this. Seems like an odd choice of UI chrome that browsers decided to keep. 0: http://www.wired.co.uk/news/archive/2012-04/25/firefox-fires-favicon http://www.wired.co.uk/news/archive/2012-04/25/firefox-fires...

schoen 12y ago

sslstrip had an option to do this in order to increase the chance that the user is fooled into not noticing the downgrade attack.